add deps validator

Signed-off-by: Keshav Priyadarshi <git@keshav.space>

Author: keshav-space

vulntotal/validators/__init__.py

@@ -21,7 +21,10 @@
 #  VulnTotal is a free software tool from nexB Inc. and others.
 #  Visit https://github.com/nexB/vulnerablecode/ for support and download.
 
+from vulntotal.validators import deps
 
-VALIDATORS_REGISTRY = []
+VALIDATORS_REGISTRY = [
+    deps.DepsValidator,
+]
 
 VALIDATORS_REGISTRY = {x.__module__.split(".")[-1]: x for x in VALIDATORS_REGISTRY}

vulntotal/validators/deps.py

@@ -0,0 +1,86 @@
+#
+# Copyright (c) nexB Inc. and others. All rights reserved.
+# http://nexb.com and https://github.com/nexB/vulnerablecode/
+# The VulnTotal software is licensed under the Apache License version 2.0.
+# Data generated with VulnTotal require an acknowledgment.
+#
+# You may not use this software except in compliance with the License.
+# You may obtain a copy of the License at: http://apache.org/licenses/LICENSE-2.0
+# Unless required by applicable law or agreed to in writing, software distributed
+# under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
+# CONDITIONS OF ANY KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations under the License.
+#
+# When you publish or redistribute any data created with VulnTotal or any VulnTotal
+# derivative work, you must accompany this data with the following acknowledgment:
+#
+#  Generated with VulnTotal and provided on an "AS IS" BASIS, WITHOUT WARRANTIES
+#  OR CONDITIONS OF ANY KIND, either express or implied. No content created from
+#  VulnTotal should be considered or used as legal advice. Consult an Attorney
+#  for any legal advice.
+#  VulnTotal is a free software tool from nexB Inc. and others.
+#  Visit https://github.com/nexB/vulnerablecode/ for support and download.
+
+import json
+from typing import Iterable
+
+import requests
+from packageurl import PackageURL
+
+from vulntotal.validator import Validator
+from vulntotal.validator import VendorData
+
+
+class DepsValidator(Validator):
+    spdx_license_expression = "TODO"
+    license_url = "TODO"
+
+    def validator_advisory(self, purl) -> Iterable[VendorData]:
+        supported_ecosystem = {
+            "npm": "npm",
+            "maven": "maven",
+            "go": "go",
+            "pypi": "pypi",
+            "cargo": "cargo",
+            # Coming soon
+            # "nuget": "nuget",
+        }
+
+        url_advisories_meta = (
+            "https://deps.dev/_/s/{ecosystem}/p/{package}/v/{version}/dependencies"
+        )
+        url_advisory = "https://deps.dev/_/advisory/{source}/{sourceID}"
+
+        if purl.type in supported_ecosystem:
+            request_advisories_meta = requests.get(
+                url_advisories_meta.format(
+                    ecosystem=supported_ecosystem[purl.type],
+                    package=purl.name,
+                    version=purl.version,
+                )
+            )
+        if request_advisories_meta.status_code == 200 and request_advisories_meta != "Not Found":
+            response = json.loads(request_advisories_meta.text)
+            advisories = response["dependencies"][0]["advisories"]
+
+            for advisory in advisories:
+                request_advisory = requests.get(
+                    url_advisory.format(source=advisory["source"], sourceID=advisory["sourceID"])
+                )
+
+                if request_advisory.status_code == 200:
+                    parsed_advisory = json.loads(request_advisory.text)
+                    affected_versions = [
+                        event["version"]
+                        for event in parsed_advisory["packages"][0]["versionsAffected"]
+                    ]
+                    fixed_versions = [
+                        event["version"]
+                        for event in parsed_advisory["packages"][0]["versionsUnaffected"]
+                    ]
+                    yield VendorData(
+                        aliases=parsed_advisory["aliases"],
+                        affected_versions=sorted(affected_versions),
+                        fixed_versions=sorted(fixed_versions),
+                        raw_dump=request_advisories_meta.text,
+                    )